This vulnerability arises from the Eclipse Jetty HTTP/1.1 parser failing to correctly terminate chunk extensions that contain unclosed quoted strings; the parser treats a CRLF within a quoted string as the end of the extension instead of raising an error, enabling an attacker to craft a chunked request that embeds a second, separate HTTP request. The flaw is classified as CWE-444 and allows remote HTTP request smuggling, potentially bypassing authentication or routing controls in downstream services.

All installations of Eclipse Jetty that lack the published fix are vulnerable; this includes the open‑source Jetty server as used by organizations such as Red Hat and other systems that embed Jetty. No particular version range was specified in the advisory, so any Jetty release prior to the patched version should be considered at risk until the update is applied.

The vulnerability carries a CVSS score of 7.4, indicating high severity, while the EPSS score of 1% reflects a low but non‑zero likelihood of exploitation. It is not listed in CISA KEV. An attacker can exploit the flaw remotely over the network by sending a crafted chunked request with an improperly closed quoted string; no authentication or local privileges are required. Successful exploitation could allow the injected request to reach downstream services undetected, potentially granting unauthorized access or causing service disruption.